One can sample uniformly at random from \(I_{d, A}\)  in time \(O(n^d)\)  which is polynomial when \(d\)  is a constant. An immediate consequence of Lemma REF  is that the set of random polynomials \(p_1, \dots , p_{\beta n}\)  can be effectively used as a membership oracle for \(A\) . Therefore, the banknote \((s_r, \ket {A_r})\) , which can be generated efficiently by the bank, consists of a superposition over the random subspace \(A_r\)  and the list of polynomials \(s_r = \lbrace  p_i \rbrace _{1 \le i \le \beta n}\)  corresponding to \(A_r\) . The hardness assumption underlying the quantum money scheme of [1]} is based on the following problem:
